PHP patches PHP2Shell after pre-disclosure attacks and precautionary outages
First merged summary.
PHP patched two critical RCE bugs on October 21 after attempts from October 17; scanning is widespread and confirmed compromises remain disputed.
Two critical PHP flaws, CVE-2026-109618 and CVE-2026-109619 (CVSS 9.2), called PHP2Shell, can allow unauthenticated remote code execution through crafted web requests and memory handling. PHP released 8.5.12, 8.4.27, 8.3.36 and 8.2.35 on October 21, a day before the planned embargo, after Chainguard published fixed images early. Amazon says a MadPot honeypot saw an attempt on October 17 and later broad exploitation by multiple actors; Cloudflare logged millions of attempts. Wordfence and Security Affairs report no confirmed successful remote code execution, and the UK government knows of no confirmed public-sector compromise even as dozens of services went offline as a precaution. Security Affairs says VulnCheck published an ASLR-bypass exploit chaining both bugs; The Register says VulnCheck’s technique is customer-only and not functional as RCE on ARM64.
- Fixed releases are PHP 8.5.12, 8.4.27, 8.3.36 and 8.2.35.
- Amazon logged a honeypot exploitation attempt on October 17.
- Cloudflare saw attempts rise from thousands to millions after disclosure.
- Wordfence intercepted more than 74,000 attempts and reports no confirmed compromises.
- Censys counted over 34.4 million still-vulnerable PHP services as of October 23.
- UK officials said 32 government services were unavailable and four partly down.
Timeline
dated events in the reporting · oldest first- Oct 17, 2026Amazon MadPot honeypot logs a PHP2Shell exploitation attempt. · The Register
- Oct 20, 2026CVE identifiers circulate; Calif briefly posts a proof-of-concept video. · CSO Online
- Oct 21, 2026Chainguard publishes fixed images about six hours before the moved embargo. · CSO Online
- Oct 21, 2026PHP releases emergency fixes for both critical flaws. · SecurityWeek
- Oct 22, 2026UK peers report 32 government services unavailable after precautionary work. · The Register
- Oct 23, 2026Censys still counts over 34.4 million vulnerable PHP services. · Security Affairs
What each outlet adds
beyond the shared facts- The RegisterUK outage counts and VulnCheck’s private, non-ARM64 RCE conditions.
- BleepingComputerEarly public proof-of-concepts were not functional, per the PHP team.
- WordfenceMore than 74,000 intercepted attempts and no confirmed compromises.
- CSO OnlineEmbargo moved from October 22; Chainguard’s early-release explanation.
- Security AffairsCensys exposure count and no confirmed successful remote code execution.
- Products
- PHP
- Organizations
- AmazonNCSCCloudflareCensysSophosVulnCheckArctic WolfCisco TalosChainguardAWSCalifOpenAI
- AI models
- GPT-5.6 Sol
Coverage
oldest first · one row per article · UTC- · 8d ago
The Register · SecurityFirst report
PHP2Shell flaws drew millions of exploit attempts, some before disclosure
Amazon saw a honeypot hit on October 17, four days before patches, and Cloudflare has since logged millions of attempts.
- · 8d ago
SecurityWeek
PHP2Shell vulnerabilities patched by multiple vendors
PHP releases 8.5.12, 8.4.27, 8.3.36 and 8.2.35 fix CVE-2026-109618 and CVE-2026-109619 allowing unauthenticated remote code execution.
Vulnerabilities in this story
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
CVE-2026-109618+1 related CVE | OOM longjmp memory flaw enabling RCE in PHP | 9.2 | 100% | KEVPoC ×25 | KEV |